Malicious file location

[Douglas]

I know a user downloaded a bad file. I also know when it
was installed. Is there a way to search for files based
on install date?

 

[JW]

Not sure how directly, but indirectly you could search all folders (only
folders - not files), using the exact date last modified. That would not
tell you which file it is exactly, but if you keep routine daily backups of
all your folders/files (like everybody should), you could compare the search
results with your routine backup of that folder from the day before.

What would be ideal would be if your routine backup taken on the "Bad File"
day was the type of backup called Daily. That would show only the files
that changed that day. If routine daily backups were all the type of backup
called Incremental (not your non-daily type of backup called Normal), then
you could get the same result by looking at the Incremental backup taken at
a time that would include file changes made on the "Bad File" day.


I know a user downloaded a bad file. I also know when it
was installed. Is there a way to search for files based
on install date?